Skip to content

Three acts of SAP AI - and the question that was not on the slides

From the launch of SAP Joule, through the AI units licensing currency, to a vision of more than 200 agents in the Autonomous Enterprise - and behind it all, a question about security, permissions and SOD that you have to ask before you sign. A column by Jacek Bugajski.

Jacek Bugajski Jacek Bugajski ·

The AI agent demo in SAP has just finished. On screen, the agent has found an overdue invoice on its own, matched it to a purchase order and proposed the posting. The room nods. And then someone in the back row asks: “But how does the agent know that the document it is reading is not lying?”

Silence.

I know that silence from many rooms. For three years the conversation about AI in SAP was a conversation about licences: who gets it, in which package, for how much. It is time for it to become a conversation about security. But one thing at a time - because this story has three acts.

Act I. The promise

On 26 September 2023, SAP Joule debuts. Christian Klein promises: “Joule will know what you mean, not just what you say.” The assistant is set to reach the entire portfolio - first SuccessFactors still in 2023, then S/4HANA Cloud public edition, then CX, Ariba and BTP. SAP talks about 300 million users and 26,000 cloud customers with access to Business AI.

The market bought that vision quickly. I too believed the direction was right - and I still do. An assistant that knows the business context of the ERP is a completely different league from a chat window bolted onto the system.

Honestly, though, one has to admit: the first versions suggested more than they did. Booking leave in SuccessFactors, navigation, finding a transaction. A solid start, no revolution. The revolution was happening somewhere else - in the price list.

Act II. The bill

A more interesting scene played out two months before the SAP Joule launch, far from the promotional material. On the Q2 2023 earnings call, Klein announced that SAP’s latest innovations would go exclusively to the cloud - public and private, within RISE. The German user group DSAG reacted sharply. Thomas Henzler of the DSAG board called the strategy “a real show-stopper and a big disappointment”.

Then came the currency. AI units - virtual units that SAP uses to bill consumption of premium functions. At their launch, SAP could not publicly say how many units a given service consumes or how much further ones cost. The market - us, the partners, too - was buying at the start with an incomplete map of consumption.

In July 2024, AI entered the commercial packages: RISE premium got a pool of AI units included, premium plus got broader access to generative functions. Sounds like a concession? More like the model closing shut: in practice, AI became a strong sales argument for a higher cloud package.

And classic S/4HANA on-premise? SAP Joule does not run there to this day, and SAP’s roadmap shows no such item. Whoever keeps the system in their own server room watches this revolution from behind glass.

Act III. A course correction, not a change of direction

From 2025 the tone shifts. February: SAP announces a transition option for those late with ECC - a subscription that lets them complete the transformation in SAP’s private cloud with a horizon out to 2033. From summer 2025 the basic SAP Joule Base package is included in cloud subscriptions at no extra cost. September: more than EUR 20 billion for a sovereign cloud in Europe and an “OpenAI for Germany” partnership for the German public sector.

In May 2026, at Sapphire, SAP presented the target picture: the “Autonomous Enterprise”. More than 50 SAP Joule assistants orchestrate more than 200 specialised agents, a SAP Joule Work interface appears, and inside SAP Joule run models from partners - including Claude from Anthropic.

It looks like a thaw. Only, read the fine print: a RISE customer gets three SAP Joule assistants in the first year, while full access from the start goes to GROW - the new public cloud. The differentiation moved from technology to the shape of the contract. The commercials softened. The direction stayed the same: everything genuinely new in SAP happens in the cloud.

Diagram: three acts of SAP AI - from the SAP Joule launch in 2023, through the AI units licensing currency, to the Autonomous Enterprise in 2026; the direction stays the same - the cloud

There is one more jarring note that gets little airtime at conferences. According to the DSAG investment report for 2026, 43 percent of members have deployed AI use cases - and among companies using AI in production, 77 percent do so on solutions from outside SAP. Between the slide and the deployment, a gap still yawns.

The question from behind the glass

And here I come back to the silence from the first paragraph. Because once the agent is already sitting inside the system - next to financial, HR and procurement data - the most important question has stopped being “in which package” and started being “on what terms”.

An AI agent reads content you do not control: emails, documents, attachments, web pages, transcripts. And it acts with the permissions you gave it. Those two sentences describe the entire new attack surface.

This is not theory. In 2023, researcher Johann Rehberger showed that it was enough to hide instructions in the transcript of a YouTube video for an AI assistant that had “watched” the film to start carrying out the attacker’s commands. In June 2025 the world learned of EchoLeak (CVE-2025-32711) - a zero-click vulnerability in Microsoft 365 Copilot, where a crafted email was enough for the assistant to exfiltrate confidential data on its own, with no click from the user at all. We wrote about it in Safe Tuesday, while the case was fresh. Two months later, CVE-2025-53773: an injected instruction told GitHub Copilot to rewrite the developer’s environment configuration and opened the door to remote code execution.

In its Top 10 for LLM applications for 2025, OWASP placed prompt injection in first place. A separate risk category became “Excessive Agency” - an agent that is too autonomous. It put a name on exactly what we are now building in SAP by the hundreds: agents with hands.

An agent is a new employee. Treat it like an employee

In SAP, an iron rule of segregation of duties has held for decades: whoever creates an invoice does not release the payment. Whole GRC departments earn their keep making sure no single user gathers a toxic combination of permissions.

And now an agent enters the system that can do both in a second.

SAP has learned part of the lesson: the “principal delegation” model assumes the agent acts within the permissions of the user on whose behalf it works, with a read/write split, an audit log and human approval at sensitive steps. That is a good foundation. Only, a foundation does not excuse you from building the rest of the house.

Classic GRC tools were designed for humans. Non-human identities - agents, technical accounts, API keys, OAuth clients - slip out of their field of view en masse, and in organisations there are already often more of them than employees. So an agent needs the same as a person on a new job: its own identity in the system, a scope of permissions tailored to the task, a review of SOD conflicts before it starts and periodic recertification. Not “a service account with SAP_ALL, because that was quicker”.

The regulator, for its part, leaves little room for interpretation here. Article 14 of the AI Act requires effective human oversight of high-risk systems - the obligations become applicable on 2 August 2026, that is in less than two weeks. NIS2 raises the bar for incident management, DORA does the same in finance. An agent in the ERP falls under all three at once.

Process first, agent second

There is one more thing on which everything depends - and I have been writing about it consistently for a long time. In From idea to an agent in production I showed that an agentic solution is designed like a business process with control points, and that the process diagram is a contract between the business, IT and governance. A few days ago, in When NOT to automate, I added the other side of the coin: an agent placed on top of a bad process does not save money, it just burns it faster.

In the world of SAP AI this principle takes on an added, security-related meaning. Because it is only from the process that everything I wrote above follows: what permissions the agent really needs (and which are redundant), where the human checkpoint stands, which steps require segregation of duties, what we log and what we will show the auditor. Whoever starts by buying AI units and leaves the process “for later” is buying autonomy without limits. First draw the process you are optimising. The agent is the last step of that drawing, not the first.

Seven questions before signing

If I had to sign a contract for AI agents in SAP tomorrow, I would put these questions on the table:

  1. Which process are we optimising, and how do we know it is worth optimising?
  2. What permissions exactly does the agent get - and are they narrower than the permissions of the human on whose behalf it acts?
  3. Is the agent’s identity visible in our GRC, and have we checked it for SOD conflicts?
  4. What happens when the agent reads a malicious instruction hidden in an email, a document or a video transcript?
  5. Where does the human checkpoint stand, and who is accountable for the consequences of the agent’s actions?
  6. Will the agent’s activity log survive a meeting with an auditor - and with Article 14 of the AI Act?
  7. How do we disconnect the agent in the event of an incident, and what can it manage to do before we do?

Diagram: seven questions before signing for AI agents in SAP - process, permissions, identity in GRC, prompt injection, human checkpoint, audit log, disconnection procedure

If the vendor answers all seven fluently - that is a partner. If they answer fluently only the question about the price list - that is a problem, just a deferred one.

Instead of a conclusion

Let us go back to the room from the start of this text. To the question “how does the agent know the document is not lying” there is an honest answer today: it does not know. And that is why the boundaries around the agent - permissions, segregation of duties, human oversight, the log - matter more than its intelligence.

I consider SAP’s direction to be right. Agents in the ERP are here to stay, and the companies that learn to use them will pull away from the rest. But the order matters: process first, permissions next, signature last. A licence can be renegotiated every year. An incident cannot be undone.

I wrote this column to start a conversation, not to close it. Three questions to which I genuinely want to know your answers: does your GRC see non-human identities - agents, technical accounts, API keys? Who in your organisation signs off on the consequences of an AI agent’s decision - and does that person know it? And when negotiating an AI package with your ERP vendor, what did you ask about first: the price or the security?

Write in the comments under the LinkedIn post or directly to me. I will cover the most interesting threads in the next piece - over the next coffee.

Jacek Bugajski is the CEO of SNOK - a Polish consulting firm specialising in SAP, cybersecurity and automation.

Sources

Topics: SAP SAP Joule AI security GRC agentic AI
Found this useful? Please pass it on:

More from this series

Other

Is this release ready? SAP testing is now a trust problem, not a test-count problem

The S/4HANA transformation changes the nature of testing: the question is no longer how many tests you ran, but whether you know what changed and which business processes are at risk. Six lessons from a UiPath webinar plus our own experience with UiPath Test Cloud.

Weekly review: AI on both sides of the front line - a botnet in six minutes, AI-discovered SAP flaws and the hard AI Act deadline

The week the same mechanism that lowers the cost of work also lowered the cost of attack: a criminal rebuilt botnet infrastructure in six minutes by talking to a model, AI discovered previously unknown flaws in SAP MDM, and the AI Act is about to enter its next phase of application.

Does RPA still make sense? Coffee-time reflections on agents, skills and young people

RPA is not dying - it is shifting its place in the puzzle. Agents take over the thinking, robots stay for the doing, and the most interesting shift is happening in people. A personal, bird's-eye view of the market, teams and hiring.

Get in touch

Get in touch Email office@snok.ai